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ABSTRACT 

The challenges of Space Shuttle Orbiter reaction control subsystem development began with selec- 
tion of the propellant for the subsystem. Various concepts were evaluated before the current Earth- 
storable, bipropellant combination was selected. Once that task was accomplished, additional chal- 
lenges of designing the system to satisfy the wide range of requirements dictated by operating en- 
vironments, reusability, and long life were met. Verification of system adequacy was achieved by 
means of a combination of analysis and test. The studies, the design efforts, and the test and anal- 
ysis techniques employed in meeting the challenges are described in this paper. 


INTRODUCTION 

The requirements for the Space Shuttle Orbiter reaction control subsystem (RCS) were replete 
with challenges,* however, four requirements had the greatest Impact on system development: (1) a 
fail-operational/fail-safe design, (2) 10 years of life, (3) a 100-mission reuse capability, and 
(4) the capability for operation both in orbit and during reentry. The requirement of a fail- 
_operational/fai 1-safe design not only introduced the complexity of additional hardware but, perhaps 
more importantly, introduced a complex, critical redundancy management (RM) system. The calendar 
life and reuse requirements posed problems in material selection and material compatibility and in 
ground handling and turnaround procedures, as well as classical wearout problems. The requirement 
for both on-orbit and entry operation complicated propellant-tank acquisition system design. 

Because requirements did not identify the need for a specific propellant or propellant combina- 
tion, an early issue that had to be resolved was that of selecting propellants. The ultimate propel- 
lant selection had a significant impact on the four requirements identified previously. 

In subsequent sections of this paper, the most significant challenges incurred in development of 
the Orbiter RCS are identified and the manner in which those challenges were met in the ultimate cer- 
tification of the system for operational flight is described. 


PROPELLANT SELECTION 


One of the first major Issues to be resolved concerning the Space Shuttle Orbiter RCS was that 
of selecting the propel 1 ant (s) to be used. Early in the program definition phase, oxygen (Op) and 
hydrogen (Hp) were baselined as the reactants for all propulsion and power systems. This choice was 
made for a number of reasons. As a propellant combination, Op-Hp provides high specific impulse. 
Logistics are simplified and less costly with a single propellant combination for all vehicle propul- 
sion systems. The exhaust products are noncorfasive, and the propellants are relatively clean and 
nontoxic - all attributes desired in a reusable system. As a result of the oxygen/hydrogen baselin- 
ing, all early technology work addressed improving the technology posture of Op-Hp systems. This 
Improvement was necessary because Op-Hp systems were far from state of the art when used for reac- 
tion control purposes. As the component technology and systems study programs progressed, the 
weight advantage thought to exist with Op-Hp propellant systems gradually diminished. The heavy 
accumulators (two per system) in combination with redundant turbopumps (six per system) and heat 
exchangers (six per system) offset the weight advantage afforded by the better performance in the 
total impulse range being considered. Because system dry weight was high, the Op-Hp systems also 
added to the vehicle landing weight penalty. 

A further factor that became more and more apparent as technology work progressed was that the 
oxygen -hydrogen systems would be very expensive to develop and build as well as extremely complex 
systems to operate. The complexity generated real concerns with respect to the reliability of the 
overall system. When it became clear that the weight of the Op-Hp system would be no better than 
that of a monopropellant system (fig. 1), the baseline was changed to a monopropellant hydrazine sys- 
tem to reduce cost and complexity. The monopropellant system baseline was retained through the award 
of the Orbiter prime contract. As the Orbiter design evolved and the total impulse requirement 
approached 2 million pound- seconds, performance again became a more important factor anchthe trade 
swung in favor of the bipropellant (monomethyl hydrazine (WH) and nitrogen tetroxide (NTO)) systems, 
which were still lighter and much cheaper and simpler than Op-Hp systems. Another factor being con- 
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FIGURE 1.- WEIGHT AS A FUNCTION OF TOTAL IMPULSE FOR CANDIDATE PROPELLANTS. 


sidered at the time was the potential for integration of the RCS with the orbital maneuvering sys- 
tem (OMS), vrtiich also used the WH/NTO propellant combination. This propellant combination ulti- 
mately was selected because of the favorable weight trade-off, the reasonable development cost, and 
the minimal development risk. 


COMPONENT DEVELOPMENT CHALLENGES 


During the course of readying each component for flight, a distinct set of development and certi- 
fication problems arose. Some were the result of well-defined, but rigid requirements. Others were 
the result of ill -defined or changing requirements; still others were the result of being unable to 
readily demonstrate satisfaction of requirements. Some of the more significant challenges encounter- 
ed during the development of the Orb iter RCS components are described next. 


SHUTTLE ORBITER RCS PROPELLANT TANKS 

For a number of reasons, Orblter Program management selected a tank concept employing a screen 
propellant acquisition device (PAD), vrfiich is used to acquire and deliver gas-free liquid to the 
thrusters. In previous spacecraft, a Teflon membrane was used to separate the propellant from the 
pressurant. However, Teflon membranes rupture after relatively few expulsive cycles and, therefore, 
would be unsuitable for 100-mission life. No elastomeric membranes that are sufficiently compatible 
with the RCS propellants to assure a 10-year life have been developed. For these reasons, and be- 
cause of Its weight advantage over the bellows-type tanks, a screen tank was chosen to provide gas- 
free liquid outflow. See figures 2 and 3 for the forward and aft configuration tanks, respectively. 
This device works by using the surface tension of the liquid to form a barrier to the pressurant gas. 
The PAD is made up of channels vrfiich are covered with a very finely woven stainless steel mesh, or 
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screen. Contact with liquid wets the screen, and the surface tension of the liquid prevents the pas- 
sage of gas. The strength of the liquid barrier is finite, and the pressure differential at which 
gas will be forced through the wetted screen is called the bubble point. When the bubble point is 
exceeded, the screen is said to "break down," or to transfer gas. However, if the pressure differ- 
ence is less than the bubble point, gas cannot penetrate the liquid barrier and only liquid will be 
pulled through into the channels. Therefore, the goal in designing the tank is to minimize the pres- 
sure loss while maximizing the amount of propellant expelled, or expulsion efficiency. The pressure 
loss is made up of two major components: the flow loss, due to viscous loss, turning loss, entrance 
loss, etc., and the hydrostatic head loss’ (fig. 4). The latter is a function of the acceleration to 
which the tank is subjected. The flow losses depend on the puddle size. As the volume of propellant 
decreases, the screen surface area in contact with the puddle decreases; thus, to supply the same vol- 
ume flow rate, the velocity must be greater and, therefore, the pressure differential must be greater. 
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The greatest flow losses occur with the smallest puddle. The expulsion efficiency of a tank is 
defined as the smallest residual at which the flow and hydrostatic head-pressure losses, combined, 
are equal to the bubble point of the screen. Because the tank is designed to work primarily in a’ 
low-g environment, the hydrostatic head-pressure term is small. However, any ground testing has to 
be performed in a one-g environment, and the hydrostatic head-pressure loss very quickly becomes the 
dominant term and, therefore, the tank performance cannot be directly determined or demonstrated in 
ground tests. This problem was the greatest engineering challenge encountered in the tank develop- 
ment program. 

To get around this problem, sophisticated math models were developed to characterize the on- 
orbit perfotmance of the tank. The math models were developed using ground test of subassemblies 
in which flow losses of each device in the PAD were measured. 

In early 1980, testing at the system level revealed a serious deficiency in the math models. In 
addition to the steady-state pressure drops, a transient-pressure drop, due to thruster pulsinq, was 
discovered. This loss had not been considered In previous analyses and was unexpected. An addition- 
al analysis indicated that when combinations of thrusters were comnanded simultaneously, the pressure 
drop associated with the opening of the thruster valves was being transmitted through the supply lines 
to the tank. There, the analysis showed, the pressure drops were high enough, with more than three 
thrusters pulsing, to cause gas ingestion and momentary screen breakdown. Because of the transient 
problem, gas could be fed out to the thruster and perhaps cause a thruster to misfire and be de- 
selected during a critical mission phase. To avoid this possibility, the number of thrusters which 
could be simultaneously coimianded per system was constrained to three thrusters for all mission phases 
except entry and return to landing site (RTLS) abort. " For entry, the acceleration vector causes the 
propellant to coyer the outlet; therefore, np transient problem is encountered. The RTLS case, how- 
ever, still required seven thrusters. To satisfy this requirement, it was necessary to "overfill" 
the aft RCS tanks. Overfill means that the tanks are loaded completely full leaving no ullage volume; 
therefore, the upper compartment screens are entirely wet and the risk of gas Ingestion is almost 
eliminated. However, overfill entailed a lengthy list of operational problems and procedures and it 
was viewed as a temporary solution to the transient problem. 

Shortly after the problem was discovered, an Intensive effort was initiated to quantify the tran- 
sient problem. Again, because the tank performance could not be defined by direct test in a one-g en- 
vironment, an advanced transient-pressure math model was developed. It was then correlated with pre- 
liminary test data obtained by the contractor from tests on a tank in one g using a test fluid and 
simulated thruster valves . A more detailed model-validation test plan was then developed using a 
iao 34 was specia11 y instrumented with highly sensitive pressure transducers, and a test entitled 
0V-102 Aft RCS. Tank On-Orbit Performance Test" was run. This test provided pressure transient data 
from an actual system. The tests were run in the worst case attitude and, because of the large hydro- 
static head-pressure loss, with a large residual puddle. The math model predictions for one-g opera- 
tion agreed fairly closely with the test results, and the model was then used to predict the expul- 
sion efficiency of the tanks for on-orbit conditions. A conservative safety factor was included in 
the predicted on-orbit performance to account for test uncertainties. 

The "on-orbit" tests, along with the math model, indicated that the abort duct in the aft RCS ~ 
tank was the device most affected by start transients in the upper compartment and also was the de- 
vice that determined the entry expulsion efficiency. Because the abort dump for which it was 
designed had been eliminated, it was decided to remove this abort duct from the 0V-099 tank. With 
this change, the updated math model Indicated that the upper compartment would not be sensitive to 
on-orbit pressure transients after the screens' are initially wetted. To test this prediction, and 
also to test the 0V-099 modification tank, a ne*f test concept was proposed. (See fig. 5.) A way had 
been found to minimize the test uncertainty due to hydrostatic head-pressure loss and to simulate the 
worst case "terminal" puddle in a one-g environment. By wrapping the screen channels with Teflon 
tape, leaving a small area uncovered at the bottom of the tank and the aft entry collector uncovered, 
a simulated low-g expulsion test could be run. With the collector as a high point, and with liquid ’ 
filled until the level is just belo* it, thrusters are fired. Because only a small screen area is 
exposed to propellant flow, the steady-state and transient losses are maximized. Because the height 
below the collector Is small, the hydrostatic head-pressure loss Is minimized and thus on-orbit condi- 
tions are simulated. The initial results indicated that the tank was performing better than the math 
model predictions. The math model developed for the forward tanks Indicated that the start transients 
were not as severe as In the aft system. Therefore, no redesign of the forward RCS (FRCS) tank was 
required. As mentioned earlier, during the first flight, as well as on all subsequent flights, the 
digital autopilot (DAP) was constrained to firing a maximum of three thrusters simultaneously. A 
study by the tank contractor, employing the latest model. Indicates that a four-thruster capability 
can be attained on normally filled aft tanks. A five-thruster capability could be achieved on an 
overfilled aft 0V-099 tank; however, because of the problems associated with overfill, this capabil- 
ity will not be pursued. The only major roadblock to deleting overfill is the RTLS, in whjch the 
DAP can comnand as many as seven thrusters simultaneously. Additional analysis performed for RTLS 
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using avionic simulations has shown that no significant quantities of gas are Ingested, Therefore, 
overfill will be eliminated by STS-8. 

With the conclusion of this study, and the 0V-099 performance testing, the RCS tank performance 
certification will be complete. 


THRUSTERS 

One of the major challenges In the Orblter RCS development was design of the primary thruster. 
The thrust sl2e was almost an order of magnitude larger than that used on previous manned spacecraft 
reaction control systems. The large thrust size coupled with a need for 38 primary thrusters made 
weight a prime consideration In component design. Because early technology work had shown that a 
hydraulically operated valve was considerably lighter than a conventional solenoid valve for a Shut- 
tle Orblter-slze engine, that concept was chosen for use on the primary thruster (fig, 6). The new 
concept introduced new problems. The valve relied on pressure Imbalances established by a pilot 
poppet to provide the necessary opening force. These valve-actuating pressure Imbalances could also 
be created by transient -pressure waves generated by other thruster or Isolation valve operation with- 
in the system. These inadvertent, momentary valve openings were demonstrated to be safe in flight 
but unacceptable for ground operation. Furthermore, it was discovered that gas entrapped in recesses 
of the valve could slow down both opening and closing valve response and also increase the tendency 
for the valve to "bounce" with pressure transients. To minimize the possibility of valve "bounce" 
during ground operations. Isolation valve operation was procedurally limited to cases in which the 
pressure differential across the valve was below 25 psid. To accommodate the slowed valve response 
with the presence of gas in the valve, the minimum thruster firing time was increased from 40 to 80 
milliseconds, which was still satisfactory for control purposes. 

An ongoing problem that has a potential for considerable downstream program impact Is the ten- 
dency of some primary thruster valves to leak when subjected to low temperature. The problem was 
first discovered when liquid was observed to be dripping from the system-level test article engines 
during a cold environment test. Additional testing at the NASA Lyndon B. Johnson Space Center (JSC) 
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FIGURE 6.- CROSS SECTION OF PRIMARY THRUSTER VALVE. 


revealed that one out of three valves leaked when chilled from ambient temperature to 30 ° F. Further- 
more, the leakage became progressively worse with Increased cycling. Preliminary corrective action 
in the form of a 40°-F screening test was introduced to eliminate "cold leakers." Continued investi- 
gation of the problem indicated that the TFE Teflon underwent a marked change in thermal expansion 
rate In the 65°- to 77°-F temperature range. Because machining, done as a part of seat fabrication, 
was accomplished In this temperature range, some parts had insufficient seat material exposed at re- 
duced temperature. The flat-seat, non-temperature-compensating design made the unit very sensitive 
to temperature changes. Therefore, to further reduce susceptibility to cold leakage, two actions. In 
addition to the screening, were Implemented. First, the Teflon Is machined at 32° F to ensure uni- 
form dimensions with adequate seat material exposed at reduced temperatures. Second, the thruster 
heater set points have been raised to maintain valve temperature above 60° F. Even with these ac- 
tions Implemented, there have been Instances of cold leakage when heater power had to be turned off 
during ferry flight operations. Whether the Incidence of cold leakage Increases as valve seat wear 
occurs with use still remains to be seen and will determine whether additional work is required. 

Another environment-induced development problem involved the requirement for the valve to be ca- 
pable of withstanding salt fog exposure. Care was exhibited In selecting materials for the valve, 
and all those selected (Inconel 718, Custom 455, and A-286) were Individually compatible with salt 
fog. However, when all the factors and materials" were assembled, a galvanic crevice corrosion on the 
Custom 455 occurred. The completed series of Ingredients that resulted In the corrosion was the 
stacking of the three valve materials against elthfer of the thruster materials, titanium or 
columblum, plus the addition of a propellant-soaked crevice around the valve seat, and lastly, the 
electrolyte, sodium chloride. Severe and rapid pitting occurred on the valve poppet (Custom 455), 
and leakage ensued. Results of material testing confirmed the four-material problem and suggested a 
material change as a corrective action. Because the failure occurred late In the production process, 
the first flight units had already been manufactured and shipped. This situation dictated consider- 
ing an Immediate corrective action for existing hardware and Implementing the material change for 
future replacements. The Inmediate corrective action was to keep the thrusters sealed against mois- 
ture and salt air Intrusion by keeping plugs and dessicant protection In place at all times when on 
the ground. To date, this approach has been satisfactory, and the long-term solution has not been 
pursued. 

Another subtle material problem occurred In the fabrication of the Injectors. During waterflow 
tests of the Injectors for the 0V-102 thrusters, water was observed to be externally leaking from the 
Injector adjacent to the acoustic cavities (fig. 7). No confirmed cause for the cracking was deter- 
mined; however, an ultrasonic screening test was Invented to Isolate the cracked injectors. The 
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screening test was Imposed at several stages In the manufacturing process In hopes of determining the 
cause. During the manufacture of the 0V-103 hardware, the problem reoccurred and the screening test 
paid off. With some good metallurgical Investigative efforts. It was determined that the columblum 
was cracking because of hot salt stress corrosion and that fluoride salt exposure, temperature, and 
stress all had to be present for cracking to occur. The fluoride salt was a residue from an inade- 
quate rinse of a chemical etch used In preparation for welding. The problem was solved by eliminat- 
ing the use of the etchant after reaching a certain stage of the Injector fabrication process. 

One of the latest challenges encountered In the development of the Space Shuttle RCS thrusters 
was a premature failure of the dlslllclde coating on the vernier engines (fig. 8). Coating failures 
were first experienced In the component qualification program and later on the flight hardware. Fail- 
ures occurred over quite a range of burn times. At first. It was thought to be a single generic prob- 
lem with the coating Itself, but as testing and Investigation progressed. It was shown to be a multi- 

faceted problem. The qualification engine coating spalled after 80 000 seconds of bum time, where- 
as two of the 0V-102 engines developed coating defects at about 10 000 seconds of burn time. Thus, 

It was theorized that not only bum time but thermal cycling as well was critical. The qualifica- 
tion and flight hardware both had approximately equal thermal cycles. This theory was negated 
when one engine spalled at 10 thermal cycles and others were spall-free after more than 800 thermal 
cycles. Evidence pointing to one potential cause was revealed during an Inspection of the OV-099 
engines performed to document their condition before their first flight. Two of the engines were 

found to have defects, with nothing more than acceptance-test bum time. Examination of the ground- 

support throat plugs revealed that metallic fingers on the plug had broken and dislodged pieces 
from the new engine coating. These throat plugs were abandoned and new ones designed to preclude 
high loads being put Into the coating. It was now obvious that the coating could have been and 
probably was mechanically damaged In some of the failures, but this mechanism did not explain all 
of them. Samples tested at the JSC White Sands Test Facility (WSTF) In a special coating test 
that had never been exposed to any throat plugs developed coating defects. Further Investigation 
determined that poor quality control In manufacture of the combustion chamber was probably contribu- 
ting to the early wearout. Ridges, undercuts, and smeared material were found in the chamber before 
coating. Coating over these Imperfections was producing weak areas, which, when cycled, were causing 
coating pinholes or spalling to occur. Combustion chamber machining was subsequently revised to con- 
trol Intersecting cuts, and the finishing cut now Is made In one direction In a single pass. Use of 
this new technique minimizes smearing and ridging. Chemical milling was Implemented before coating 
to further remove any smears and ridges remaining from machining and to remove any contaminants burled 
in the surface. Testing to verify the Improved manufacturing process Is underway. 
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FIGURE 8.- VERNIER THRUSTER COATING FLAM. 




A/C MOTOR ISOLATION VALVES 

An interesting subsystem Interface issue that arose on the flight vehicle involves the RCS A/C 
motor Isolation valves and their control circuitry. The RCS isolation valves are ball valves that 
are driven by high-speed alternating-current motors (fig. 9). The response of the ball is slow, ap- 
proximately 1 second for full travel in either direction, but the motor is rotating at 8000 rpm. The 
gear reduction is large, and large Inertia force In the gear train Is partly removed by a friction 
brake upon stopping. The valve was built with microswitches for terminating power at the end of 
valve travel. The original design accoomodated the large Inertia by removing power from the motor 
before the mechanism came to rest. By this means, the ball and gear train could "coast down" before 
Impacting the friction energy absorber. The absorber was designed to marginally handle the antici- 
pated inertia load. The valves cycled without problems when operated Individually and had in fact 
completed development testing and part of qualification life testing without mishap. However, when 
used In the vehicle, the oxidizer and fuel Isolation valves were actuated as pairs. Power was left 
on until the slowest of the two valves completed Its cycle. Thlr mode of operation drove the qear 
train of the fastest valve hard Into the energy absorber and left stall torque on the motor until 
the slower valve completed travel and power was shut off. The added momentum of the gear train as a 
result of powered Impact with the energy absorber caused the absorber to recoil and produce a sudden 
Inelastic reaction load Into the gear train. Repeated cycling of the paired valves could cause the 
nylon teeth of the third-stage planetary gear to strip and, thus, disable the valve. The first In- 
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FIGURE 9.- A/C MOTOR VALVE CROSS SECTION. 


dication of this problem occurred when the 0V-102 forward module RCS was checked out at the NASA 
John F. Kennedy Space Center (KSC). The valves were being cycled with a 2-second timing circuit, 
and It was noticed that the microswitch feedbacks were Intermittent. On closer Investigation, It 
was discovered that power in excess of 1.15 seconds could cause Intermittent open/close indications 
because the gear train would backlash enough to cause an open circuit to occur on the microswitch. 
Further investigation Indicated that the vehicle wiring would leave power on for greater than 1.15 
seconds and, therefore, could cause Intermittent Indications. Driving a valve beyond the microswitch 
turnoff signal was known as a "hard cycle." Testing on the A/C motor valve was begun to pursue the 
effects of "hard cycling" on "paired" valves. It was discovered that the reliable life of the valve 
was no more than several cycles. Work was Initiated on redesigning the gear train to accomnodate the 
larger loads. The resultant product was a new, all-metal gear train Incorporating a magnetic brake 
in the motor and a different, and significantly better, energy absorber for the Inertia load, de- 
signed to sustain the full Inertia load plus motor stall torque driving Into the stop. Certifica- 
tion testing of the new valve verified that the new configuration could achieve the required full 
100-mission life in the hard-cycle mode. 
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RCS SYSTEM-LEVEL DEVELOPMENT AND CERTIFICATION 




Q.i 


A major challenge with any liquid propulsion system such as the Space Shuttle RCS is to verify 
that all the components combined as a system operate as a unit during all expected operating modes 
and that the interaction between components will not cause problems. A second significant activity 
required on a system-level test article is the development and verification of all ground checkout 
and servicing procedures necessary for a multiuse vehicle. To ensure that these goals were met and 
also to verify system structural Integrity, a major ground test program was performed on the RCS 
(fig. 10). This ground test program included the following major elements. 

1. FRCS and ARCS Breadboard Development Test 

2. FRCS and ARCS Development Tests 

3. FRCS and ARCS Qualification Tests 

4. RCS Thruster Installation Tests 

5. ARCS Pressure Panel Tests 

6. RCS and ARCS Vibroacoustic Tests 

The major objectives of these test programs were as follows. 

1. RCS and ARCS Breadboard Development- Test - Provide early system data to support the anal- 
ysis and design efforts and to evaluate servicing and checkout procedures. Simulated propellants 
were used in this test. 



FIGURE 10.- TYPICAL SYSTEM TEST ARTICLE (RCS). 
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2. FRCS and ARCS Development Tests - Conduct 12 test series on the FRCS and 11 test series on 
the ARCS at WSTF to verify RCS design, including evaluation of steady-state and transient performance 
under all operating conditions, and develop and evaluate servicing and checkout procedures. This was 
the first actual system hot-fire testing on complete FRCS and ARCS test articles. 

3. FRCS and ARCS Qualification Tests - Conduct sufficient test series on the FRCS and ARCS to 
certify the system for development and operational flights. These tests were divided into Qua! I 
(STS-1), Qual II (operational flights), and Qual III (0V-099 and subsequent modifications). Thirteen 
test series were performed on the FRCS and 15 on the ARCS with each series approximately equivalent 
to one mission. 

4. FRCS Thruster Installation Tests - Provide data for thermal and structural certification of 
the complex RCS thruster installation. The firing tests were performed at simulated altitude at 
WSTF, and the vlbroacoustic tests were performed at Rockwell International (RI). 

5. ARCS Pressure Panel Tests - Certify the RCS helium pressurization system for simulated se- 
ries regulator failures including relief system limit testing. 

6. FRCS and ARCS Vlbroacoustic Tests - Provide data to certify FRCS and ARCS primary and second- 
ary structure, components, and tubing for the acoustic environments experienced during ascent. The 
FRCS test was conducted at RI and the ARCS at JSC. ,, 

Numerous challenges resulted from the problems discovered during the ground test programs 
listed. Some of the major challenges and the eventual technical solutions are discussed next. 

The breadboard test program revealed two major problems requiring resolution, 

~ 1. Servicing procedures resulted in propellant residual entrapment in the helium pressurization 

lines. Subsequent activation of the system by opening the fast-response helium Isolation valves 
produced pressure surges that would sometimes rupture the burst disk in the helium relief system. 

This problem was solved procedurally for the 0V-102 vehicle by implementing a series of pressure 
cycles called "breathing cycles" which cleared the liquid from the helium lines. For OV-099 and sub- 
sequent vehicles, the problem was solved by a change in the helium system plumbing to add a separate, 
dedicated propellant vent line. 

4 . 

2. The ARCS breadboard test revealed that certain combinations of engine firings produced pres- 
sure transients in the propellant feed system in excess of the design limits. The pulse characteris- 
tics were also erratic under these conditions. As a result of this finding and parallel findings 
from the development testing at WSTF, the minimum pulse on /off duration and frequency were changed 
from an Initial value of 0.040 second on/0.040 second off with a maximum frequency of 12.5 hertz to 

0.080 second on/0.080 second off with a maximum frequency of 6.25 hertz. This change resulted in 
more propellant usage in some cases but eliminated the pressure transient concern and resulted in 
much more repeatable pulse performance with the corresponding reduced risk of engine pressure spikes 
and erroneous deselections by the Shuttle RM system. This change was a major step in improving the 
reliability of the RCS. 

Challenges resulting from RCS system-level development and qualification testing were numerous. 
Some of the major challenges involved engine valve problems, servicing and activation problems, 
propellant -tank checkout, propel! ant -tank surge-^flow evaluation, and subsystem life certification. 

The first major challenge occurred very early In development testing and involved engine/system 
incompatibilities. The Initial plan was to fill the RCS tanks with propellant and the manifolds with 
low-pressure gas. During system activation, the propellant Isolation valves were opened and the gas 
was compressed; these actions left large gas bubbles in the RCS feed system and engine valves. As 
discussed in another section of this report, the primary engine valve operation is adversely affected 
by gas entrapment. During initial FRCS system-level testing, major problems occurred including 
missed pulses, failure of valves to close between pulses, long Ignition delays, cold flows of one pro- 
pellant due to oxidizer and fuel valve mismatch, and valve bounce due to system pressure transients. 
This inefficient operation also caused concern for potential hard-start (spike) problems resulting 
from residue accumulation in the combustion chambers. The following plan was implemented to solve 
these problems. 

1. Change the loading procedure to a vacuum-fill process to eliminate gas bubbles. 

2. Perform bench tests on the thruster valves to map performance characteristics as a function 
of gas entrapment/flow, static and dynamic pressure, propellant saturation, etc. 

3. Install linear variable differential transformers on some thruster valves on the FRCS and 
ARCS test articles to determine effects of gas bubbles, saturated propellants, and system pressure 
transients. 
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4. Change minimum pulse on and off times from 0.040 second to 0.080 second. 

5. Run system-level tests with vacuum-filled manifolds and saturated propellants to verify ade- 
quacy of modification. 

6. Perform single engine pulse tests at altitude simulating conditions seen In step 5 to deter- 
mine whether oxidizer and fuel residuals cause problems at altitude. 

This program was successful in characterizing the valve and valve/system Interactions. The test 
program also revealed that the corrective actions of vacuum filling and changing the minimum pulse 
time were adequate to allow the thruster valve to be used for flight without major valve or system de- 
sign changes. 

Problems of engine valve leakage at cold temperatures and low pressure and engine valve bounce 
caused by upstream Isolation valve or quick -disconnect cycles were also discovered in system-level 
testing. These problems were solved by procedural controls and are discussed more fully in the sec- 
tion entitled "Thrusters." 

Checkout of the RCS propellant-tank surface-tension acquisition screens proved to be another 
major challenge. For the screens to perform properly in flight, there must not be any holes in the 
screen that will cause a reduction of the bubble-point pressure. It is desirable to have a technique 
that allows contingency and periodic checkout of the screens during operations without removing the 
propellant tanks or using fluids other than the propellants. The basic process proposed for this 
checkout Involves filling the tanks with propellants, draining them without drying the propellant 
from the screens, and then determining the bubble point (pressure at which gas penetrates the wet 
screen surface) through the special checkout ports provided for this purpose. This process proved to 
be fairly easy to implement for the fuel tank because of the low vapor pressure of MMH. Implementing 
the process for the oxidizer tank, however, proved to be a very difficult task because of the high 
vapor pressure of NT0. All initial attempts to check out screens on the system level with oxidizer 
proved to be unsuccessful because the screens dried out. This challenge was met by Implementing a 
special test program on the tank alone with simulated system-level checkout access plumbing and 
valves. This approach allowed for experimentation with thermal control, tank orientation, and propel- 
lant saturation level of the nitrogen gas Introduced into the tank. This approach finally revealed 
the key controls that must be used to allow checkout with oxidizer. The most Important parameter 
requiring control is the saturation level of the gas. The incoming pressurant gas (nitrogen) must be 
saturated with propellant. Second, the incoming gas must be at the same temperature as, or warmer 
than, the tank, and third, the tank pressure should be In the 60- to 70-psl range. The concept was 
then proven on system-level tests, and current plans are to implement It for the operational phase of 
the program at KSC. 

Test effort on the system level caused the development of some very effective techniques for 
evaluating the complex surface-tension acquisition devices. The use of X-rays was found to be very 
effective In determining the locations of propellants In the tank for evaluating performance, loading 
and drain procedures, and potential acquisition device gross damage. Elaborate Instrumentation con- 
cepts were also developed to evaluate surge-flow pressure differentials In the tank. These were used 
to evaluate pressure differentials for high flow rates into and out of the tank associated with 
crossfeed/interconnect operations and propellant manifold repressurization. High-response piezoelec- 
tric instrumentation was also used to determine dlfferenti-al pressures across the screens to evaluate 
engine start transient effects In the tank. 

Another challenge associated with system-levejl testing Involved life certification for 10 years 
and 100 missions. Obviously, a 10-year/100-m1ss1on life test would be very expensive. Therefore, 
the concept used was to certify the individual components in bench-type environments for 100 missions 
of cycle life and vibration exposure and to run short, 90-day screening tests for propellant compati- 
bility. The components and the system were then tested In a development program representing 11 to 
13 missions over an approximately 9-month period. This test was followed by a qualification test pro- 
gram representing 13 to 15 missions spread over a 3-year period. Including other special tests, the 
qualification hardware was exposed to 4 to 5 years of operation. All operations on the systems were 
designed to be representative of actual Space Shuttle servicing, flight, and repair procedures. The 
acoustic test articles were exposed to a full 100-mission or more equivalent exposure in a short time 
period except for the FRCS module, which was exposed for only 10 missions and analyzed for the re- 
maining 90 missions. All failures or problems were analyzed for any life-limiting Indications, 
and, if a life limit was Indicated, it was so noted and Identified as limited-life hardware. The 
described approach was then used for 10-year/100-m1ssion certification with any exceptions being 
noted. 


The ARCS vlbroacoustlc test revealed a problem very late In the certification program that 
required extensive effort to solve. Initial testing on an ARCS pod structure revealed that vibration 
levels on Individual components and zones In the pod were higher than had been previously predicted 


667 



and were higher than the levels used for component certification. This pod was originally equipped 
with “mass simulated," nonfunctional components with the Idea that the levels would be equal to or 
less than the levels used in component tests. Therefore, component tests could be used for certifica 
tlon. Since the levels were higher, a decision was made to use the vlbroacoustlc pod for component 
certification. This decision required a last minute change to Install functional components in the 
pod and complete the component and system certification in this manner. Since the levels were higher 
in the ARCS, test results could also be used to certify the FRCS components for 100 missions. The 
FRCS had only been tested for 10 missions as a system. 


RCS INTERFACES 

The Orbiter RCS is the most complex RCS ever designed. To use It effectively requires major RCS 
interfaces with avionics /software, wiring, instrumentation, thermal control, and structures sub- 
systems. A major challenge in the RCS design was to ensure that compatible interfaces exist within 
these areas. Although difficult interface challenges existed In each of the areas, perhaps the most 
difficult was the RCS/avionics/software interface. Only this Interface will be discussed here. Rrln 
cipal functions performed in the Shuttle avionics /software for the RCS are redundancy management, 
quantity monitoring, RCS crossfeed sequencing, OMS-to-RCS Interconnect sequencing and gaging, FRCS 
propellant dump, trickle-current testing, and system monitoring and annunciation functions. All 
these functions required extensive exchange of information between subsystems to ensure that the soft 
ware and the avionics hardware were compatible with the RCS hardware In terms of timing, sequencing, 
limit sensing, redundancy requirements, etc. The most complex avionics /software Interface is the 
area of redundancy management. The purpose of the RM system is to monitor the 44 RCS engines, an- 
nunciate and isolate failures, and reconfigure the system to maintain vehicle control during all mis- 
sion phases. This function is necessary to effectively maintain the RCS fai 1 -operational /fall -safe 
redundancy. The major elements of the final system design are as follows. 

1. Fail-off detection - compares computer fire comnand with engine chamber pressure feedback to 
determine whether engine has fired. If no response occurs in an appropriate time, the engine is de- 
clared falled-off, annunciated to the crew, and taken out of the available jet table In the computers 

2. Fail -on detection - compares jet driver output with computer fire comnand to determine 
whether an engine is firing with no comnand. If a failed-on engine is detected. It Is annunciated 
to the crew so that the appropriate manifold may be Isolated to prevent excessive propellant loss. 

3. Valve leak detection - monitors engine fuel and oxidizer Injector temperatures to determine 
whether engine valve leakage is occurring. If the temperature of the oxidizer Injector tube Is below 
30° F or of the fuel Is below 20° F because of rapid propellant evaporation, a leak Is Indicated. 

For a leak indication, the problem is annunciated to the crew and the engine Is taken out of the 
available Jet table. The crew may then manually close the appropriate Isolation valves If propellant 
loss Is excessive. 

4. Manifold status monitor - monitors RCS manifold Isolation valve positions to determine 
whether valves are open or closed. If the valves are closed, the engines on that manifold are 
removed from the available jet table. 

5. Oet fault limit monitor - limits number of jets which may be automatically removed from the 
available jet table in response to failure Indications. This function Is designed to ensure that the 
RM system will not automatically remove engines to levels at which Insufficient control authority 
exists. 

All RM functions may be overridden by the crew In all phases except for ascent, for which only 
limited override capability Is available. To date, this system has been very effective in detecting 
RCS engine problems and managing RCS redundancy In flight. 

The other major avionics/ software interfaces are now briefly described. Quantity monitoring 
uses RCS helium and propellant-tank pressure and temperature measurements to calculate and display 
the RCS propellant status at all times using the pressure/volume/temperature relationship to deter- 
mine the quantity of helium gas that has been transferred from the helium tank to the propellant 
tank. The RCS crossfeed sequence provides automatic sequencing of 28 RCS/0MS valves to feed RCS en- 
gines In both aft pods from the RCS propellant tanks in a single pod. The sequence will also recon- 
figure to normal feed and is operational only In ascent and entry phases. The OMS-to-RCS Intercon- 
nect sequencing and gaging performs the 0MS/RCS valve sequencing required to feed 0MS propellants to 
RCS engines during abort dumps and to reconfigure to normal feed after the dump Is completed. During 
on-orbit operations of normal missions, the OMS-to-RCS Interconnect sequence Initiates OMS-to-RCS 
gaging and automatically pressurizes the 0MS tanks as required. The on-orbit valve sequencing is a 
manual operation. The FRCS propellant dump sequence provides capability for the crew to dump the 
FRCS propellant through opposing Y-axis engines for center-of -gravity control. The trickle -cur rent 
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test Is used to check the electrical circuits that provide voltage to fire the RCS engines. Various 
RCS pressures and temperatures are limit sensed, displayed, and annunciated by the avionic/ software 
Interface to alert the crew of potential RCS problems. 


OPERATIONS 

Operations challenges for the RCS can be divided into two major categories: ground operations 

and flight operations. More emphasis is placed on ground operations because most major operations 
challenges have occurred in that area. As an Introduction to ground operations, the basic opera- 
tional concept for the RCS and the OMS Is described. 

The basic design concept for the hypergollc systems with their toxic, flamnable propellants Is 
to Include the systems in modules or pods that can be removed from the Shuttle Orblter and taken to 
a dedicated maintenance facility for hazardous repair or checkout operations. This facility is 
called the Hypergolic Maintenance Facility (HMF). By performing hazardous operations In the HMF , the 
work can be done in parallel with other Orblter work and, thus, valuable turnaround time between 
flights can be saved. The HMF is also used to perform lengthy checkout operations, whether hazardous 
or not, to save serial turnaround time. The modules or pods are also provided with access panels and 
numerous plumbing access connections to enable performance of most checkout functions in the Orblter 
Processing Facility (OPF) without removal from the vehicle. The decision on whether to perform re- 
pair or checkout in the OPF or the HMF is usually based on access and turnaround time considerations. 

Development of ground checkout philosophy has been^a major challenge for a reusable system that 
contains highly corrosive propellants, Is used on a continuous basis in flight, and has considerable 
redundancy. The general philosophy that has been developed is as follows. A complete electrical and 
mechanical checkout on the FRCS module and the ARCS pods is performed by the manufacturer before the 
units are delivered to be installed on the Orblter. The interfacing Orblter electrical and instrumen- 
tation wiring is also checked out using module and pod simulators before the actual hardware Is in- 
stalled. The most critical components and the system plumbing integrity are checked again in the 
HMF before final Installation on the Orbiter. After the module and pods are Installed for the first 
Orblter flight, the electrical components are checked for proper end-to-end channelization where pos- 
sible by actual physical response, e.g., flow, pressure, or temperature response. The system Is then 
loaded with propellants and helium on the launch pad. During the actual flight, the system pressures, 
temperatures, quantities, and valve positions are monitored closely for any indication of malfunction. 
Special procedures are also used to get as much component functional data as is reasonably possible 
by changing from one operational component to a redundant component during each mission; this Is done 
with regulator paths, heaters, and engines. Special hot-fire tests are also performed to check out 
engines that might not normally be used. Use of this technique verifies the functional capability of 
as many components as possible to reduce ground checkout requirements. After the Orblter lands, com- 
ponent checkout is performed on a very limited number of components every flight based on their crit- 
icality and whether they can be checked out In flight. Most components are only checked out on a 
5- or 10-mission basis to screen for unexpected deterioration. The system plumbing is leak checked 
by monitoring for pressure decay at normal turnaround pressures after every flight. The engine cham- 
ber and nozzle coating is also Inspected for defects after every flight. By using the described ap-_ 
proach, the turnaround time is minimized without excessive sacrifice in reliability. 

One of the first major challenges encountered In actual operations was the need to provide rain 
protection for some of the Orbiter engines aft$r the protective structure was moved away and the pro- 
tective ground covers were removed from the RCS engines. The requirement was to protect the three 
upward-facing engines and eight of the left side engines from rainwater accumulation on the launch 
pad. The upfiring engine covers had to prevent water accumulation that could freeze in the Injector 
passages during ascent. The side-firing engine covers had to prevent water from accumulating in the 
bottom of the chamber and to protect the chamber pressure-sensing ports. Freezing of accumulated 
water during ascent could block the sensing port and cause the engine to be declared "failed off" 
when it was first used. The original design concept was to install Teflon plugs in the engine throats 
(side-firing) and a combination Teflon plug tied to a Teflon plate that covered the nozzle exit 
(upfiring). This concept added vehicle weight, required special procedures to eject the plugs In 
flight, and had the risk of accidental ejection in ascent that could damage tiles. The second con- 
cept evaluated Involved Teflon sheets that were glued to the nozzle exits and pulled off by lanyards 
when the crew access structure was retracted. This concept was considered to be unnecessarily com- 
plex and did not provide protection all the way to launch or for all the engines. The final solution 
was a novel approach of using ordinary plastic-coated freezer paper cut to fit the exit plane of the 
nozzle and glued in place (fig. 11). Tests proved this concept would provide a reliable seal under 
all expected rain and wind conditions. Wind-tunnel tests revealed that the covers could bio# off in 
ascent before Mach 1. The covers were, therefore, very low cost, simple, and added no significant 
weight. 
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FIGURE 11.- PAPER ENGINE COVER. 


The next major operational challenge Involved RCS engine valve leakage problems during ground 
turnaround. Following the first orbital flight of the Shuttle, the FRCS module and the ARCS pods 
were removed for Inspection and checkout. A test was performed to evaluate the capability to evacu- 
ate the manifolds after they had been drained of propellant but not completely dried. Following this 
test, four RCS engine oxidizer valves developed high gas-leak rates. This leakage caused great con- 
cern because the leak rate was high enough to Indicate that the valves might leak liquid. To under- 
stand the problem, one of the engines was removed for failure analysis. This failure analysis, in 
combination with the analysis performed on another engine removed for a different reason, revealed 
the causes for the leakages. The valves had low Teflon seal height and some nitrate deposits In the 
seal area. The drying of the oxidizer system by evacuation caused Teflon shrinkage, which. In combina- 
tion with the nitrates, caused leakage. It was expected that rewetting the seal with liquid oxidizer 
would swell the seal and dissolve the nitrates and, therefore, prevent liquid leakage. Experience 
has shown that this does happen. The KSC turnaround procedures were changed to preclude drying the 
RCS manifolds by evacuation unless they are to be refilled Immediately with liquid. The problem of 
oxidizer valve gas leakage during turnaround has not recurred. 

Prevention of Iron nitrate contamination In the RCS oxidizer proved to be another operational 
challenge. Storage of oxidizer in tanks and plumbing that contain Iron has been found to cause iron 
contamination in the propellant. This contamination can form a nitrate that can precipitate and 
cause valve leakage, filter blockage, Interference In sliding fits, etc. Several RCS component fail- 
ures were related to this problem; the most prominent one was the failure of a ground-half quick dis- 
connect to close resulting In an oxidizer spill on the launch pad just before STS-2. A program was 
Implemented at WSTF to determine the parameters that cause Iron nitrate formation and then to Imple- 
ment procedures to prevent their formation In Shuttle propellants. This program resulted In under- 
standing the relationship between Iron, water, and nitric oxide content and nitrate formation. 

Also, production and storage controls and filtration techniques to remove the Iron were developed. 

With the implementation of these controls, the Iron nitrate problem appears to have been solved. 
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Another major operational challenge was development of the best procedures for ferry flight of 
the Orbiter RCS after a mission. Because of the initial concern for engine valve leakage at cold tem- 
peratures and propellant slosh effects on tank screens, the RCS propellants were drained at the land- 
ing site before ferry flight. Following STS-2, the drain operation had two valve sequencing errors 
that subjected the RCS propellant tanks to potentially damaging surge flows. These errors were attri- 
buted to the remote location of the drain site and the difficulty of communications betjveen the drain 
site and KSC, where the systems data were available. Consequently, the operations site (KSCl recom- 
mended that the propellant not be drained before ferry flight. This reconmendation was accomplished 
after STS-3 by turning the RCS thruster heaters and FRCS area heaters on through a special hookup to 
the carrier airplane. The carrier airplane was also instrumented with a special accelerometer to 
monitor for excessive slosh loads on the RCS tanks. A recognized risk was taken that 15 to 25 per- 
cent of the RCS thruster valves might leak as much as 10 cnn/hr of liquid propellant during ferry 
flight even with the heaters on. This approach has been successful on all ferry flights from STS-3 
to the present with only minor leakage occurring in a few engines. Damaging slosh loads have never 
been encountered. 

The incidents that occurred during draining at the landing site created another major operations 
challenge. There was concern that the RCS tank screens and/or internal bulkhead structure might have 
been damaged by the surge flow into the tanks. Since the RCS tank checkout procedures by bubble- 
point technique had not been fully developed at that time and no ground -support equipment (GSE) was 
available to perform in-place tank checkout, the only way to check the tanks was to remove them and 
send them to the manufacturer for checkout. This action would have been a major impact to the pro- 
gram schedule and to hardware deliveries for subsequent vehicles. To avoid this impact, a decision 
was made to attempt to duplicate the surge incidents on the ARCS test system at WSTF and then to 
check out the test tanks to determine whether damage occurred. This resulting test program required 
a meticulous duplication of all the procedures that had been performed on the systems at the landing 
site. This duplication was particularly challenging since data were not available during some pe- 
riods at the landing site and the crossfeed plumbing and the GSE were different at WSTF than on the 
Arbiter. The test program was successfully completed, and results indicated that the tanks on the ve- 
hicle were not damaged. This testing resulted in saving about 2 months on the Shuttle schedule, since 
the tests at WSTF were run in parallel with the other Orbiter operations and no checkout times were 
required for the tanks. 

The next major operations challenge occurred after STS-3, when the Shuttle Orbiter landed at 
White Sands, New Mexico. Just after landing, high winds blew gypsum sand into the RCS engines before 
they could be covered. This event caused concern that the injector orifices could be blocked and 
thus cause unstable combustion and/or improper cooling of the combustion chamber walls. Results of 
bench tests revealed that the gypsum would migrate into the passages of the injector, particularly on 
the upfiring engines, where the gypsum accumulated on the injector face. Results of bench tests also 
revealed that the gypsum would harden and cake when exposed to propellants or water such as seen in 
ferry fTight (cold leakage and moisture from the air). To solve this problem, a plan was implemented 
to remove and replace all nine of the upfiring engines and to remove three horizontal -firing engines. 
The three horizontal -firing engines were inspected and test fired to ensure that no detrimental ef- 
fects were seen. Data from these three engines were then used to clear the other horizontal engines 
for flight. 

A general program goal during the operational phase has been to improve/reduce turnaround 
time and operations. The RCS program has been very successful in this area to date, and additional 
reductions are expected in the near future. Major turnaround Improvements to date include the 
following. 

1. Deleted screen drying requirement - 16 (hours. 

2. Developed computer program to track nitric oxide content in oxidizer and thus deleted re- 
quirement for postflight oxidizer samples - 8 hours. 

3. Deleted requirement to drain and refill tanks and manifolds between flights - 2 to 3 days. 
Turnaround improvements in work include the following. 

1. Delete overfill requirement on the ARCS propellant tanks - 1 to 2 days. 

2. Improve loading procedures - 8 hours. 

These improvements have been achieved primarily by implementing special programs on the test articles 
at WSTF to ensure that the changes are acceptable. The testing has also been supplemented by anal- 
ysis efforts in some cases. * 
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Numerous problems or challenges and their solutions have been Identified in this paper. The so- 
lutions to the problems have produced satisfactory operational hardware. The real achievement in com- 
pleting the development program, however, was not in the final hardware Itself but in what was learned 
to make that hardware possible. Those real achievements on this program must become the routine work- 
ing tools for the next major effort so that the creative engineers of tomorrow may spend their time 
constructively in dealing with tomorrow's challenges. 



